v2.23.0

https://www.npmjs.com/package/codex-multi-auth/v/2.23.0

npm i -g codex-multi-auth@2.23.0

OAuth, health, quota, and device-auth requests now honor HTTP_PROXY/HTTPS_PROXY/NO_PROXY, status gets a compact default view with a codex-ma web live dashboard, resume --last picks the provider from the session Codex will actually reopen, and native WebSocket forwarding survives upstream drops with automatic HTTP recovery. (#742, #740)

Added

• Proxy-aware HTTP: every outbound call — OAuth, device auth, health checks, quota probes, runtime traffic — resolves HTTP_PROXY/HTTPS_PROXY/NO_PROXY (lowercase wins, loopback destinations always bypass). Embedding hosts can pin the transport via setProxyFetchImpl, and a non-platform global fetch installed before module load is honored. (#742)
• Compact status by default: codex-multi-auth status and list print a compact table — subscription and API/ZDR accounts together, blocked accounts counted separately from ready, and quota windows labeled from their real windowMinutes instead of hardcoded 5h/7d. --details restores the previous diagnostic view; --json keeps a stable shape including runtime: null on an empty pool. (#742)
• Locale selection: output follows --locale → CODEX_MULTI_AUTH_LOCALE → saved locale setting → system detection (en/zh), covering detailed status, WebSocket disconnect lines, and the dashboard page and startup messages. A blank CODEX_MULTI_AUTH_LOCALE is treated as unset. (#742)
• Local web dashboard: codex-ma web (new codex-ma alias) serves a loopback-only, live-refreshing pool dashboard over SSE with --host/--port/--token/--interval/--no-open. Untokened loopback binds reject foreign Host headers to defeat DNS rebinding, malformed requests return 400 instead of crashing the process, missing browser openers no longer kill the server, disconnected SSE clients are cleaned up eagerly, and backpressured clients are dropped rather than accumulating unbounded queues. (#742)

Fixed

• resume/fork provider selection: the wrapper resolves the source session's provider for both commands — resume --last filters candidates to the current working directory unless --all, a positional prompt after --last no longer defeats the lookup, and only a bounded rollout header is read instead of the full transcript. Native openai sessions keep their native provider. (#742)
• WebSocket transport preservation and recovery: the native WebSocket transport survives upstream disconnects, rejected sessions are reclaimed safely at capacity, and upgrade rejections (capacity vs admission) share one diagnostics path. (#740)